I use HyperV. The server reboots once a month for security updates.
Guests - it depends on the OS the guest is running. I follow standard best practice for each OS. The server has encrypted drives, and each VM disk is also encrypted.
Remote Admin - SSH, Remote Desktop, Powershell etc. Standard management protocols. Since I have the IPSEC VPN always running, I can use anything.
I'm aware that I could be hacked if someone sufficiently skilled wanted to take me down, but that's true of anything stored online. I've achieved a reasonable level of security and I have control over my data.